Interseguro and Uruguay notaries under claims

Interseguro said it detected unauthorized access to information stored in its systems on Oct. 7. The company blocked the compromised access, renewed credentials and security keys, and tightened infrastructure controls. It said the incident was limited to its own systems and that it notified the relevant authorities and customers whose data may have been affected.

What information did Interseguro say may have been affected?

Interseguro said that, based on its internal analysis, the information involved was mainly identification data, contact details, and policy numbers. It also said policies, coverage, claims handling, and benefit payments continued to operate normally.

The insurer, part of Intercorp, also said the case remained under review and that it had reinforced its internal measures after the discovery. The statement did not publicly detail how the initial access occurred or attribute the incident to any specific group.

What did the ransomware groups say?

Nightspire listed the Asociación de Escribanos del Uruguay as a victim on its leak site, but the source that reported the claim did not independently confirm the intrusion or the exfiltration. The material describes the organization as Uruguay’s national association of notaries.

Meanwhile, Direwolf allegedly included Interseguro on an extortion portal and claimed to have obtained confidential information. According to the source, that claim mentioned roughly 2.5 terabytes, internal files, and personal records, although none of those elements has been independently confirmed.

What can be confirmed today about these two claims?

Based on the available information, only two recent mentions on ransomware-related sites can be verified, one tied to the Asociación de Escribanos del Uruguay and the other to Interseguro. In both cases, the data posted by the threat actors or by tracking sites is not enough on its own to confirm the intrusion, the true scope, or any exfiltration.

In Interseguro’s case, there is a formal admission of unauthorized access and a preliminary description of the type of data that may have been exposed. In the Uruguayan case, the entry observed on the leak site did not provide enough independent evidence about the incident or specific TTPs.